From 0303ff06b99e8d5b466692771358e1226f253661 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 25 Aug 2021 17:14:31 -0400 Subject: [PATCH 1/4] updating detection from feedback in issue 1557 --- ...eating_lnk_file_in_suspicious_location.yml | 32 +++++++++++-------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index fcb8010707..3a7c021ac2 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -1,24 +1,30 @@ name: Process Creating LNK file in Suspicious Location id: 5d814af1-1041-47b5-a9ac-d754e82e9a26 -version: 4 -date: '2021-01-28' +version: 5 +date: '2021-08-25' author: Jose Hernandez, Splunk type: TTP -datamodel: [] +datamodel: + - Endpoint description: This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" - AND Filesystem.file_path="C:\\Temp*" by _time span=1h Filesystem.process_id Filesystem.file_name - Filesystem.file_path Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)` - | rename process_id as lnk_pid | join lnk_pid, _time [| tstats `security_content_summariesonly` + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" AND (Filesystem.file_path="C:\\User\\*" OR Filesystem.file_path="*\\Temp\\*") + by _time span=1h Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.file_hash Filesystem.user + | `drop_dm_object_name(Filesystem)` + | rename process_guid as lnk_guid + | join lnk_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time - span=1h Processes.parent_process_id Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)` - | rename parent_process_id as lnk_pid | fields _time lnk_pid process_id dest process_name - process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | table firstTime, lastTime, lnk_pid, process_id, user, dest, file_name, file_path, - process_name, process, process_path, file_hash | `process_creating_lnk_file_in_suspicious_location_filter` ' + span=1h Processes.parent_process_guid Processes.process_id Processes.process_name + Processes.dest Processes.process_path Processes.process + | `drop_dm_object_name(Processes)` + | rename parent_process_id as lnk_guid + | fields _time lnk_guid process_id dest process_name + process_path process] + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | table firstTime, lastTime, lnk_gui, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash + | `process_creating_lnk_file_in_suspicious_location_filter` ' how_to_implement: You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data From 1f5c139f60b2a1296a89e829938a9cda3cc9f5dc Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 31 Aug 2021 12:09:55 -0700 Subject: [PATCH 2/4] Update process_creating_lnk_file_in_suspicious_location.yml --- .../process_creating_lnk_file_in_suspicious_location.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 3a7c021ac2..28e7eef459 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -83,3 +83,4 @@ tags: - Filesystem.user risk_score: 63 security_domain: network + From 39db6357ae98a01de062349ed0253f986c7cce8e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 31 Aug 2021 13:08:47 -0700 Subject: [PATCH 3/4] Update process_creating_lnk_file_in_suspicious_location.yml --- .../process_creating_lnk_file_in_suspicious_location.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 28e7eef459..78b5d67d35 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -1,7 +1,7 @@ name: Process Creating LNK file in Suspicious Location id: 5d814af1-1041-47b5-a9ac-d754e82e9a26 version: 5 -date: '2021-08-25' +date: '2021-08-26' author: Jose Hernandez, Splunk type: TTP datamodel: From 7a7341f9bac7a6d9e3404c80ce33b6859de2269e Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 31 Aug 2021 13:48:25 -0700 Subject: [PATCH 4/4] spl update --- ...eating_lnk_file_in_suspicious_location.yml | 33 ++++++++++--------- 1 file changed, 17 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 28e7eef459..ae02da2623 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -9,22 +9,23 @@ datamodel: description: This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" AND (Filesystem.file_path="C:\\User\\*" OR Filesystem.file_path="*\\Temp\\*") - by _time span=1h Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.file_hash Filesystem.user - | `drop_dm_object_name(Filesystem)` - | rename process_guid as lnk_guid - | join lnk_guid, _time [| tstats `security_content_summariesonly` - count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time - span=1h Processes.parent_process_guid Processes.process_id Processes.process_name - Processes.dest Processes.process_path Processes.process - | `drop_dm_object_name(Processes)` - | rename parent_process_id as lnk_guid - | fields _time lnk_guid process_id dest process_name - process_path process] - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | table firstTime, lastTime, lnk_gui, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash - | `process_creating_lnk_file_in_suspicious_location_filter` ' + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk" AND (Filesystem.file_path="C:\\User\\*" OR Filesystem.file_path="*\\Temp\\*") + by _time span=1h Filesystem.process_guid Filesystem.file_name Filesystem.file_path Filesystem.file_hash Filesystem.user +| `drop_dm_object_name(Filesystem)` +| rename process_guid as lnk_guid +| join lnk_guid, _time + [| tstats `security_content_summariesonly` + count FROM datamodel=Endpoint.Processes where Processes.process_name=* by _time + span=1h Processes.parent_process_guid Processes.process_id Processes.process_name + Processes.dest Processes.process_path Processes.process + | `drop_dm_object_name(Processes)` + | rename parent_process_guid as lnk_guid + | fields _time lnk_guid process_id dest process_name + process_path process] +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| table firstTime, lastTime, lnk_guid, process_id, user, dest, file_name, file_path, process_name, process, process_path, file_hash +| `process_creating_lnk_file_in_suspicious_location_filter`' how_to_implement: You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data